Agent Injection
Frequency:Emerging
Category:Security
Malicious Agent Introduction
AI Guardrails
AI agent guardrail failures — where safety constraints break down and how to harden them
22 patterns
AI agent guardrail failures — where safety constraints break down and how to harden them. We've tracked 22 distinct AI Guardrails patterns across production AI agent deployments — most commonly in Security, Operations, Multi Agent Systems systems. One recurring example: Agent Injection — Malicious Agent Introduction
Each pattern below documents the specific failure mode, why it happens, and how teams have mitigated it in practice — use this page as a reference when building guardrails, writing evals, or debugging an agent that's already misbehaving in this way.
Related comparisons
Audit Evasion
Frequency:Rare
Category:Security
Agent Actions Not Properly Logged or Traceable
Autonomous System Safety Failures
Frequency:Occasional
Category:Security
AI-Controlled Physical Systems Cause Harm
Chatbot Manipulation
Frequency:Common
Category:Security
Users Trick Chatbots Into Harmful Actions or Statements
Contingency Plan Missing
Frequency:Very Common
Category:Operations
An agent generates a plan as a single linear sequence of steps with no fallback for what to do if a given step fails, returns an unexpected result, or becomes unavailable. When the primary path breaks partway through execution, the agent has no pre-defined alternative to fall back to and either halts entirely, retries the same failing step indefinitely, or improvises an ungrounded workaround on the spot with no guardrails.
Credential Exposure
Frequency:Common
Category:Security
Agent Leaks API Keys, Passwords, or Tokens
Data Leakage
Frequency:Common
Category:Security
Agent Exposes Sensitive Information
Loss of Data Provenance
Frequency:Common
Category:Security
Data Origin and Classification Lost During Processing
Excessive Agency
Frequency:Common
Category:Security
Agent Takes Actions Beyond Expected Scope
Human-in-the-Loop Bypass
Frequency:Occasional
Category:Security
Circumventing Human Approval Controls
Insufficient Isolation
Frequency:Common
Category:Security
Agent Actions Escape Intended Boundaries
Missing Prompt Injection Guardrails Framework
Frequency:Common
Category:Operations
System prompt instructions are the only defense against prompt injection and unsafe output, with no established guardrails/scanning framework wired in front of or behind the model call.
Multi-Tenant Data Leakage
Frequency:Occasional
Category:Security
Agent Leaks Data Between Tenants Due to Insufficient Isolation
Output Manipulation
Frequency:Common
Category:Security
Malicious Inputs Craft Harmful Outputs
Over-Scoped Agent Permissions
Frequency:Very Common
Category:Security
Agents Provisioned with Excessive Access Beyond Task Requirements
Privilege Escalation
Frequency:Occasional
Category:Security
Agent Gains More Access Than Intended
Prompt Injection
Frequency:Common
Category:Security
Malicious Input Hijacks Agent Behavior
Shadow AI Data Exposure
Frequency:Very Common
Category:Security
Employees Use External AI Tools, Leaking Sensitive Data
Shutdown Resistance
Frequency:Occasional
Category:Security
Agent Ignores or Delays Shutdown Commands to Complete Tasks
Supply Chain Attacks
Frequency:Occasional
Category:Security
Compromised Tools or Dependencies Attack Agent
Unauthorized Actions
Frequency:Occasional
Category:Security
Agent Performs Actions Beyond Its Authority
AI Verifier Agent Fails to Catch Errors: Causes and Fixes
Frequency:Common
Category:Multi Agent Systems
A judge/verifier agent -- a pattern common to LLM-as-judge and OpenAI Agents SDK guardrail setups -- approves worker-agent output that is actually wrong, because it's checking surface plausibility rather than verifying against ground truth.